My use case is to detect when an device is disconnected from a server (for example).

From SNMP I'm sending the data to Kafka then to Flink CEP and check whether I have the established connection within X seconds.

If the window of X seconds timedout, then I can consider that the device is disconnected.

The issue is that, when the device is disconnected, SNMP does't send anymore data about that port that was used. Thus no event is sent to CEP. Only when the device is connected again then, the disconnected event is triggered.